PHP Memory Flaw CVE-2026-109618 Added to CISA KEV Catalog

What happened?

On 26 October 2026 CISA added CVE-2026-109618, a PHP vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog, which only lists flaws with evidenced active exploitation. According to the NVD entry the vulnerability itself was published on 21 October 2026, and the entry was last modified on 26 October 2026. The new development is mainly the catalog listing.

The issue concerns out-of-memory handling. PHP aborts request processing with a jump mechanism in such cases. Some code paths reportedly do not account for this and leave request memory uninitialized before allocating. The later cleanup routine can read or branch on that memory. Several out-of-memory strategies can trigger this reliably and lead to remote code execution. The feed entry describes it as unauthenticated.

Who is affected?

The source does not state which PHP versions are affected or which versions contain a fix. In general, anyone running PHP may be relevant, for example on web servers, content management systems or shop systems. Whether a specific installation is affected cannot be judged from the available information.

Why does it matter?

The ratings are high: NVD assigns 9.8 (critical) under CVSS 3.1 and the PHP publisher 9.2 (critical) under CVSS 4.0. Attacks are possible over the network, and the CVSS 3.1 vector requires no privileges or user interaction. CVSS 4.0 rates attack complexity as high. Since CISA evidences active exploitation, there is concrete need to act, especially for internet-facing PHP applications.

The source lists weakness types including use-after-free (CWE-416) and use of uninitialized resources (CWE-824).

What should organizations do now?

CISA requires affected US agencies to apply mitigations per vendor instructions, follow its guidance on risk-based update prioritization and forensic triage, and stop using the product if no mitigation is available. This is a sensible reference for businesses elsewhere too.

• Inventory all systems running PHP, including web hosting, CMS and shop software.
• Identify which are internet-facing and handle those first.
• Check vendor advisories from PHP and your hosting or software provider for updates and mitigations.
• Apply updates or mitigations promptly; without a fix, restrict exposed services.
• Review logs for unusual crashes, memory errors and suspicious access, and involve forensics if in doubt.
• Ask your service providers whether they are affected and when fixes will arrive.